Could Facebook be storing the email addresses/phone numbers in hashed form? They should not need to hold onto the cleartext one, and if it's hashed, there's no temptation (or danger) of it being used to send unsolicited emails.